Listen to this Post
Introduction: When a Public Portal Becomes a Data Breach
A new cyber-extortion operation has moved from making alarming claims to demonstrating that at least some of those claims are backed by real stolen information. ExfilSquad, a newly emerged data-extortion group, has published large collections of allegedly stolen data connected to organizations in government, education, financial services, transportation, manufacturing and other industries.
The development is particularly concerning because the available evidence points toward a less dramatic but highly effective attack path: misconfigured external-facing Microsoft Power Pages and unauthorized access to Microsoft Dynamics 365/Dataverse environments.
For organizations using cloud-based business applications, this is an uncomfortable reminder that attackers do not always need a sophisticated zero-day, ransomware payload or advanced malware. Sometimes, the most damaging weakness is a permission that was accidentally left open.
Security researchers have now examined portions of the material associated with ExfilSquad and concluded that at least some of the group’s claims appear credible. At the same time, not every allegation has been independently verified, meaning organizations and security teams must distinguish between confirmed exposure, attacker claims and unresolved investigations.
ExfilSquad Appeared With an Aggressive Victim List
ExfilSquad first became publicly visible in late July 2026, announcing a collection of alleged victims in a concentrated burst. The names included government agencies, schools, universities, financial institutions, technology companies, manufacturers and transportation organizations.
Threat-intelligence monitoring confirms that
That initial wave immediately raised questions about whether the group had genuinely compromised so many unrelated organizations or whether some of its claims were exaggerated.
Early intelligence assessments were cautious. SOCRadar, for example, initially described many of the group’s claims as unverified and noted the possibility of reused or fabricated information.
That uncertainty has become more complicated as actual data samples have appeared.
The August Data Dump Changed the Picture
The situation escalated when ExfilSquad began publishing data allegedly belonging to its victims.
According to the original analysis, 13 organizations were included in the published dumps, with the attackers claiming that negotiations had failed. The combined archive was reported at approximately 382.64 GB and 27 million records.
The important issue is not simply the size of the archive.
It is the nature of the information.
Large databases containing names, dates of birth, organizational identifiers, contact information and other personal information can become useful long after the original incident has disappeared from the headlines.
For criminals, stolen databases can support phishing, identity fraud, impersonation, social engineering and follow-on attacks.
For victims, the damage can therefore continue for years.
Government and Education Data Make the Incident More Serious
Among the organizations named in the campaign were the City of Atlanta, the UK Department for Education, and the Police National Legal Database.
The UK Department for Education incident has separately been reported as involving more than 600,000 records containing personal and professional contact information. Computer Weekly reported that the breach involved an external-facing helpdesk and that the UK government was working with the NCSC, NCA and ICO.
This is an important distinction.
The ExfilSquad story is no longer simply about a threat actor publishing a list of names on a leak site. At least some incidents have developed into independently reported security investigations.
The Department for Education Case Shows the Human Side of the Attack
The UK education incident is particularly significant because the exposed information reportedly included names, email addresses and telephone numbers belonging to government and education-sector personnel.
The Department for Education said the exposed information was limited to customer-service contact information and that it had taken steps to contain the incident.
That may sound less severe than the theft of passwords or financial records.
It is not necessarily harmless.
A database of authentic names, organizational roles, telephone numbers and email addresses can become an extremely valuable reconnaissance resource for criminals.
An attacker does not always need a password when they already know who works where, what department they belong to and how to contact them.
Student Information Raises an Even Bigger Concern
District of Columbia Public Schools was also named by ExfilSquad.
According to the material described in the original report, the attackers claimed they would not publish the complete dataset because it contained information about children. Instead, they released a censored version.
The published material reportedly included approximately 60,000 records, including student names, dates of birth and unique identifiers.
Whether an attacker publishes every stolen record or only a portion of it, the underlying security failure remains serious.
Children cannot simply change their date of birth.
They cannot easily change historical student identifiers.
And once personal information enters criminal ecosystems, removing every copy can be nearly impossible.
Not Every Original Victim Appeared in the Dump
An important detail is that Zenith Bank and Analog Devices were reportedly absent from the 13 published datasets, despite having appeared among the original claims.
This demonstrates why cybersecurity reporting must distinguish between a threat actor’s allegation and independently established compromise.
Analog Devices, for example, separately disclosed unauthorized access to its systems and confirmed that some files had been exfiltrated, while saying it was still assessing the validity, scope and potential impact of the ExfilSquad-related claims.
The company also said its operations were not disrupted.
That makes the situation more nuanced than simply labeling every ExfilSquad victim as confirmed.
The Most Interesting Question: How Did ExfilSquad Get In?
The central technical question is now shifting from “Did ExfilSquad steal the data?” to “How was the data exposed in the first place?”
Fortra’s Intelligence and Research Experts team, known as FIRE, believes a likely explanation involves improperly configured Microsoft Power Pages environments connected to Microsoft Dataverse.
The theory is especially interesting because it does not require a traditional server exploit.
Instead, an attacker may have found an externally accessible business portal that was configured to provide more data access than intended.
Power Pages Can Become a Data Exposure Point
Microsoft Power Pages is designed to allow organizations to build external-facing websites and portals.
These portals can interact with business information stored through Microsoft Dataverse and related Dynamics 365 services.
That architecture is useful for customer portals, employee services, partner systems, public forms and other applications.
But external accessibility introduces an obvious security requirement:
The portal must expose only the information that anonymous or authenticated users are explicitly allowed to access.
A mistake in table permissions can undermine that model.
Microsoft’s documentation specifically warns about assigning the Anonymous Users web role to table permissions because it can allow unauthenticated visitors to read table data when configured that way.
This is not the same thing as saying Power Pages itself is vulnerable.
The distinction is critical.
The risk comes from configuration and authorization design, not necessarily from a Microsoft software vulnerability.
Misconfiguration Can Be More Dangerous Than a Zero-Day
Cybersecurity teams often spend enormous resources looking for zero-days.
Meanwhile, an incorrectly configured cloud application can sit online for months.
That creates an uncomfortable security paradox.
An organization can have endpoint detection.
It can have a next-generation firewall.
It can deploy EDR across thousands of machines.
It can run vulnerability scanners every night.
And an attacker can still walk through an externally exposed business portal because the application itself believes the visitor is allowed to read the underlying data.
That is why identity, authorization and cloud configuration deserve the same attention as traditional vulnerability management.
Dataverse Exports Offer a Potential Clue
Fortra reportedly observed that the leaked datasets resembled exports from Microsoft Dataverse.
That observation is important because structured Dataverse-style information can provide clues about how an attacker interacted with the underlying environment.
Rather than stealing arbitrary files from an operating system, an attacker who obtains unauthorized read access to a business application may be able to retrieve organized records directly from the application’s data layer.
That can produce clean, highly structured datasets containing customer, employee, student, case-management or administrative information.
From an extortion perspective, this is extremely valuable.
Attackers May Have Been Looking for Exposed Portals
Fortra’s analysis suggests that victims may have been identified through automated discovery and enumeration of publicly accessible Power Pages instances.
The researchers reportedly found more than 10,000 potentially public Power Pages instances during their own research.
That number is one of the most important lessons in the entire incident.
Attackers do not necessarily need to know which organization has made a mistake.
They can search for the mistakes first.
Once an exposed portal is discovered, the attacker can determine whether it provides access to valuable data.
This changes the economics of cybercrime.
Automation turns thousands of small configuration mistakes into a potentially enormous attack surface.
Why Only 15 Victims Could Actually Be a Clue
At first glance, a campaign involving approximately 15 organizations may appear too small to support the theory of automated scanning.
In reality, it may tell us something important.
If the attackers were exploiting a widespread vulnerability in a popular product, we might expect a dramatically larger victim count.
But if they were searching for specific misconfigured portals containing valuable data, a smaller number of successful targets makes more sense.
The attacker could scan thousands of portals, discard the majority and focus only on environments that expose commercially or operationally valuable information.
This is classic opportunistic reconnaissance adapted to cloud applications.
The Real Weakness Is Often Authorization
Authentication answers one question:
Who are you?
Authorization answers another:
What are you allowed to see?
Modern cloud incidents increasingly demonstrate that the second question can be more important.
An application may correctly authenticate a visitor—or intentionally allow anonymous access—but still expose data because authorization rules were configured too broadly.
That means security testing must go beyond checking whether a login is required.
Teams need to test what every role can actually retrieve.
Deep Analysis: Auditing Power Pages and Dataverse Exposure
Start With External Exposure
Security teams should begin by identifying every Power Pages portal associated with their tenant and business units.
The objective is not simply to find websites.
The objective is to determine which portals are reachable from the public internet and what information they can return.
Review Anonymous Access
The Anonymous Users role should receive particular attention.
Organizations should inspect table permissions and determine whether anonymous access is genuinely required.
If it is not required, it should be removed rather than left enabled for convenience.
Review Dataverse Table Permissions
Every externally accessible table should have an explicit business justification.
Security teams should ask:
Which tables are exposed?
Which columns can be returned?
Which users can access them?
Is anonymous access required?
Are filtering rules enforced?
Can records belonging to other users be queried?
Can large numbers of records be retrieved?
Are sensitive fields unnecessarily exposed?
Use Microsoft Audit Data
Microsoft environments should be monitored for unusual access patterns.
For organizations using Microsoft Sentinel or another SIEM, queries can be adapted to identify anomalous cloud activity.
For example, a defensive KQL investigation can begin with Azure/Entra audit activity:
AuditLogs
| where TimeGenerated > ago(7d) | summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Result | order by Events desc
This does not prove Power Pages exploitation by itself.
It provides a baseline for understanding administrative and identity activity around the suspected incident period.
Look for Unusual Identity Activity
A second investigation can focus on suspicious authentication behavior:
SigninLogs
| where TimeGenerated > ago(7d) | summarize Attempts=count(), Successes=countif(ResultType == 0) by UserPrincipalName, IPAddress, AppDisplayName | order by Attempts desc
Security teams should investigate unusual combinations of accounts, IP addresses, applications and geographic locations.
Search for Administrative Permission Changes
Authorization changes deserve special attention:
AuditLogs
| where TimeGenerated > ago(14d) | where OperationName has_any ( "Add member", "Update", "permission", "role" ) | project TimeGenerated, OperationName, InitiatedBy, TargetResources, Result | order by TimeGenerated desc
The exact audit-event names vary by environment, so defenders should adapt the query to their Microsoft logging configuration.
Test From the Outside
Organizations should also conduct controlled external validation.
The goal should be to verify whether unauthenticated visitors can retrieve data that should remain protected.
This testing should be performed against systems the organization owns or has explicit authorization to assess.
Monitor API Access
Power Pages can expose application functionality through web APIs.
Therefore, security teams should monitor application and web telemetry for unexpected API activity, especially large volumes of requests against data-related endpoints.
The key signal is not one unusual request.
It is a pattern.
A visitor that suddenly requests thousands of records is far more interesting than a normal user loading a handful of portal pages.
Establish Data-Volume Thresholds
Cloud applications need behavioral monitoring.
A portal designed to return a handful of records should not silently permit a client to retrieve hundreds of thousands.
Organizations should consider alerts for:
unusually high request volumes;
repeated pagination;
bulk record retrieval;
abnormal geographic sources;
unexpected user agents;
repeated requests across multiple tables;
sudden activity outside normal business patterns.
Review Public Portal Inventory
Perhaps the most important defensive command is not a command at all.
It is maintaining an accurate inventory.
Security teams cannot protect public-facing portals they do not know exist.
Every Power Pages environment should have an owner, business purpose, data classification and documented authorization model.
What ExfilSquad Reveals About Modern Cloud Attacks
The ExfilSquad case illustrates how the cloud has changed the definition of an attack surface.
There may be no malware.
There may be no ransomware executable.
There may be no suspicious PowerShell script.
There may be no dramatic command-and-control infrastructure.
Instead, the attacker interacts with a legitimate cloud service that has been configured incorrectly.
That makes these incidents harder to identify using traditional endpoint-centric security tools.
Data Extortion Is Becoming More Efficient
Traditional ransomware requires attackers to compromise systems, deploy encryption, disrupt operations and maintain persistence.
Data extortion can be much simpler.
If attackers can obtain valuable information without deploying ransomware, they may not need to interfere with business operations at all.
The victim may continue working normally while the attacker quietly copies information.
Only later does the organization discover that its data has become leverage.
Sensitive Data Is a Long-Term Weapon
The stolen information does not become useless simply because a ransom deadline expires.
Names and contact details can support phishing.
Organizational information can support impersonation.
Student information can facilitate targeted social engineering.
Police-related information can expose personnel to additional risks.
Financial-sector information can be combined with other datasets.
This is why data breaches should be treated as potential future attack infrastructure, not merely historical incidents.
The AI Era Makes Data Exposure Even More Dangerous
There is another emerging dimension.
Large language models and automated agents can process enormous quantities of structured stolen information far faster than a human criminal operator.
A dataset containing millions of records can be transformed into searchable intelligence.
Attackers can potentially use automation to identify executives, high-value targets, organizational relationships, likely phishing themes and other useful patterns.
This means the value of stolen structured data may increase as offensive automation becomes more capable.
What Security Leaders Should Learn From This Incident
The lesson is not to stop using Microsoft Power Pages.
The lesson is to stop treating cloud configuration as a secondary security concern.
External-facing applications need the same security discipline traditionally applied to servers.
Every portal should have:
an owner;
a documented purpose;
a defined data classification;
least-privilege permissions;
monitored API access;
continuous configuration review;
logging;
incident-response procedures;
periodic external security testing.
The strongest cloud security program assumes that a configuration mistake will eventually happen.
The objective is to discover it before an attacker does.
What Undercode Say:
The Quiet Attack Surface Is the Dangerous One
The most disturbing part of the ExfilSquad story is not the size of the alleged archive.
It is the possibility that ordinary cloud functionality provided the path to the data.
Attackers Do Not Always Need Zero-Days
Cybersecurity conversations often focus on sophisticated exploits.
But authorization mistakes can produce equally damaging outcomes.
Public Portals Need Private-Level Security
An external-facing portal may be designed for public access, but that does not mean its underlying business data should be public.
Dataverse Changes the Equation
Structured business databases are extremely attractive to data thieves because the information is already organized.
Automation Makes Discovery Cheap
If thousands of potentially exposed portals can be discovered automatically, attackers can afford to search continuously.
Victim Selection Can Become Data-Driven
Criminals can prioritize portals that appear to expose high-value datasets instead of randomly choosing organizations.
Small Victim Counts Should Not Create False Confidence
A campaign targeting only a handful of organizations can still represent a much larger underlying scanning operation.
Misconfiguration Can Survive for Months
A dangerous permission setting may remain unnoticed because everything continues functioning normally.
Traditional EDR Has Blind Spots
Endpoint security cannot necessarily detect a legitimate cloud API returning data to an unauthorized visitor.
Identity Is Not Enough
A strong identity platform cannot compensate for weak authorization.
Least Privilege Must Apply to Applications
Least privilege is not only an employee-access principle.
It must apply to APIs, portal roles, database tables and automated services.
Anonymous Access Deserves Special Attention
Any anonymous permission touching sensitive data should be treated as a high-priority configuration review.
Data Minimization Reduces Damage
If a portal does not need to expose a field, that field should not be available.
Sensitive Columns Need Protection
Names may appear harmless individually.
Names combined with dates of birth, identifiers and organizational roles can become extremely sensitive.
Bulk Retrieval Is a Major Signal
Normal portal behavior generally differs from automated extraction.
High-volume requests should trigger investigation.
API Monitoring Is Becoming Essential
Cloud APIs are now part of the primary attack surface.
Security Teams Need External Visibility
Internal scans cannot fully replicate what an internet-based attacker can discover.
Asset Inventory Is Fundamental
Unknown portals create unknown risk.
Cloud Governance Must Become Continuous
A secure configuration today can become insecure tomorrow after an administrative change.
Change Management Matters
Permission modifications should be logged, reviewed and attributable to a responsible administrator.
Security Testing Must Include Authorization
Testing only whether an application is vulnerable to code execution is not enough.
Business Logic Can Be the Vulnerability
A system can be technically functioning exactly as designed while still exposing the wrong information.
Data Extortion Changes the Threat Model
Attackers increasingly want information rather than encrypted systems.
Availability Is Not the Only Security Objective
A company can remain operational while suffering a catastrophic confidentiality breach.
Education Data Is Particularly Sensitive
Student records deserve stronger safeguards because affected individuals may have limited ability to protect themselves.
Government Data Creates Secondary Risks
Government-related contact and identity information can become useful in impersonation and social-engineering campaigns.
Financial Data Has High Criminal Value
Even when passwords and account balances are not exposed, customer information can facilitate targeted fraud.
Stolen Data Can Be Recombined
Attackers can merge breach data with information from previous incidents.
Breach Impact Can Compound Over Time
A single leaked database may become more dangerous as new datasets are added to criminal repositories.
AI Can Accelerate Data Abuse
Automation can turn millions of raw records into targeted intelligence.
Defenders Can Also Use Automation
The same principle works in favor of defenders.
Automated configuration checks can continuously identify risky permissions before attackers discover them.
Cloud Security Needs Red-Team Thinking
Organizations should regularly ask what an anonymous internet visitor could discover.
The Internet Is the Ultimate Attack Surface
Anything publicly reachable eventually becomes a candidate for automated reconnaissance.
Security by Default Is the Goal
External portals should begin with restrictive permissions rather than broad access.
Convenience Creates Risk
Temporary permissions often become permanent when nobody owns the cleanup process.
Ownership Must Be Clear
Every public portal should have someone responsible for its security.
The Real Warning Is Bigger Than ExfilSquad
Even if every detail of the
Cloud applications are becoming databases with websites attached.
Configuration Is Now a Security Boundary
The boundary is no longer simply the corporate firewall.
It includes identity, SaaS permissions, APIs, data models and application logic.
Final Undercode Assessment
ExfilSquad’s emergence should be treated as a warning rather than an isolated extortion story.
The combination of automated discovery, cloud applications, excessive permissions and structured databases creates a powerful formula for modern data theft.
The organizations most likely to withstand this threat will not necessarily be those with the largest security budgets.
They will be those that know exactly what they expose, why they expose it and who is allowed to read it.
✅ ExfilSquad Publicly Listed Multiple Organizations
Threat-intelligence sources confirm that ExfilSquad published a large initial list of alleged victims on July 26, including government, education, financial and technology organizations.
✅ The UK Department for Education Incident Has Independent Reporting
The UK Department for Education confirmed a data-security incident, while reporting indicated that more than 600,000 records were involved and that authorities including the NCSC, NCA and ICO were engaged.
✅ Analog Devices Confirmed Unauthorized Access
Analog Devices separately disclosed unauthorized access and confirmed that some files had been exfiltrated, although the company said it was still assessing whether the incident was connected to ExfilSquad.
⚠️ The Power Pages Attack Path Is a Leading Theory, Not a Universally Proven Fact
The theory that ExfilSquad obtained victim data through misconfigured Power Pages and Dataverse environments is based on Fortra’s analysis.
It should therefore be described as the leading suspected mechanism, rather than an established fact for every victim.
⚠️ Not Every ExfilSquad Claim Has Been Independently Verified
Early threat-intelligence research specifically warned that some of the group’s claims could be fabricated or involve reused information.
❌ ExfilSquad Should Not Automatically Be Described as a Conventional Ransomware Operation
Available evidence more strongly supports a data-extortion model than a confirmed ransomware-as-a-service operation.
There is currently insufficient evidence to attribute a conventional encryption-based ransomware infrastructure to every incident associated with the group.
Prediction
(+1) Cloud Authorization Security Will Become a Major Enterprise Priority
The ExfilSquad campaign highlights a direction that is likely to become increasingly important over the next several years: attackers targeting permissions and data access controls rather than traditional infrastructure vulnerabilities.
As organizations move more business processes into SaaS platforms, externally accessible portals will increasingly become part of the primary security perimeter.
Security teams will likely expand continuous cloud-configuration monitoring, automated permission analysis and external attack-surface discovery.
(+1) Automated Exposure Discovery Will Grow Rapidly
Attackers will increasingly use automation to identify exposed portals, APIs, storage resources and misconfigured SaaS applications.
Defenders will respond with their own automated discovery systems.
The result will be an ongoing race between organizations attempting to close configuration gaps and attackers attempting to find them first.
(+1) Data Extortion Will Continue Growing
Attackers do not always need to encrypt a victim’s infrastructure to create financial pressure.
If sensitive data can be stolen quietly and released publicly, the criminal operation can avoid some of the complexity associated with ransomware deployment.
(-1) Cloud Misconfiguration Will Remain One of the Most Persistent Enterprise Risks
Organizations will continue adding SaaS applications faster than security teams can manually review them.
That creates an expanding gap between what companies deploy and what security teams actually understand.
(-1) Personally Identifiable Information Will Become More Valuable to Attackers
As criminal groups combine information from multiple breaches, apparently ordinary contact records can become part of highly detailed profiles.
This means the consequences of a breach may persist long after the original database disappears from public attention.
(+1) Continuous Authorization Testing Will Become Standard
The strongest long-term response will be to test cloud applications continuously—not simply ask whether a portal is online, but determine exactly what information an unauthenticated or low-privilege user can retrieve.
That shift from vulnerability scanning toward continuous authorization validation could become one of the defining changes in enterprise security.
Final Analysis: The New Battle Is Over Who Can Read the Data
ExfilSquad’s campaign offers a glimpse into a broader transformation in cybercrime.
The most dangerous attacker may not be the one carrying the most sophisticated exploit.
It may be the one who discovers an ordinary business portal that quietly exposes extraordinary amounts of information.
That is why organizations should look beyond malware, ransomware and zero-days.
The modern cloud perimeter includes every public portal, API, table permission, identity role and application endpoint.
If one of those components is configured incorrectly, the attacker may not need to break through the door.
They may simply be allowed to walk in.
And in the era of automated reconnaissance and AI-assisted data processing, a single forgotten permission can become the starting point for a breach measured not in megabytes, but in millions of identities.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
